Security and keys
How keys are stored, how workspaces are kept apart and what to do if a key leaks.
On this page
You bring your own provider keys, so keeping them safe is the core of airepeat. This page explains how.
How keys are storedLink to this section: How keys are stored
- Keys you type into the dashboard are encrypted with AES-256-GCM under a master key that can be rotated.
- They're never shown again after you save them. To change one, replace it.
- They're only decrypted for the job that needs them.
- They never appear in logs, the audit log or the dashboard; the audit records a key by its name only.
Per-workspace keys include your provider keys, AI keys, alert SMTP settings, GitHub webhook secrets and preview passwords.
Keys for sitesLink to this section: Keys for sites
Secret values for a site, such as a payment provider's secret key or an SMTP password, are typed in once and held in memory only until they're delivered to Coolify, for at most 10 minutes. airepeat doesn't keep them.
Workspaces are kept apartLink to this section: Workspaces are kept apart
Every workspace brings its own keys, servers, Coolify, GitHub, DNS and AI keys. Every query is scoped to the workspace, and every action is checked on the server against your role.
Requests to addresses you chooseLink to this section: Requests to addresses you choose
When airepeat calls an address you configured, such as your Coolify, an Ollama server or an SMTP host, it resolves the name once, refuses private, loopback, link-local and cloud metadata addresses, and connects to exactly that address. Redirects aren't followed automatically.
Abuse protectionLink to this section: Abuse protection
Sign-up, sign-in, AI work and other actions are rate limited. Names, domains, descriptions and prompts are checked for impersonation and clearly illegal requests. Anyone can report abuse.
If a key leaksLink to this section: If a key leaks
- Revoke the key at the provider.
- Create a new key with the same permissions.
- Replace it in Integrations.